centralize route authentication check. #11